Vulnerability CVE-2022-36021: Information
Description
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| redis | sisyphus | 7.0.12-alt1 | 7.2.4-alt1.1 | ALT-PU-2023-4982-3 | 327278 | Fixed |
| redis | sisyphus_e2k | 7.0.12-alt1 | 7.2.4-alt1.1 | ALT-PU-2023-5079-1 | - | Fixed |
| redis | sisyphus_riscv64 | 7.2.0-alt0.port | 7.2.4-alt0.port | ALT-PU-2023-5217-1 | - | Fixed |
| redis | p10 | 6.2.13-alt1 | 6.2.14-alt1 | ALT-PU-2023-5230-3 | 327639 | Fixed |
| redis | p10_e2k | 6.2.13-alt1 | 6.2.14-alt1 | ALT-PU-2023-5452-1 | - | Fixed |
| redis | c10f1 | 6.2.13-alt1 | 6.2.13-alt1 | ALT-PU-2023-5229-3 | 327640 | Fixed |
| redis | c9f2 | 6.2.13-alt1 | 6.2.13-alt1 | ALT-PU-2023-5487-2 | 328853 | Fixed |
| redis | p11 | 7.0.12-alt1 | 7.2.4-alt1.1 | ALT-PU-2023-4982-3 | 327278 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv |
|
| https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84 |
|